---
title: "Claim Visitor Session"
method: POST
path: "/api/me/visitor-claims"
tags: ["me"]
---

# Claim Visitor Session

`POST /api/me/visitor-claims`

## Request

- Base URL: `https://app.thinqos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.thinqos.com/api/me/visitor-claims`
- Auth: none declared

Hand an anonymous embed visitor's conversation to the signed-in caller (TOS-4550).

Same-site only: this is an authenticated ``/api/me`` route, reached with
the caller's own session, not the CORS-scoped ``/api/embed`` surface. It
exists because ``thinqos.com`` and ``app.thinqos.com`` are same-site, so a
visitor token minted while chatting on the marketing site is readable from
this app's own ``localStorage`` once the person signs up here. A visitor
embedded on a THIRD-PARTY customer domain is storage-partitioned from this
origin and cannot reach this route at all; that case is out of scope (see
TOS-4550) and is not silently pretended to work.

``resolve_visitor`` is called with ``same_origin_transport=True`` for the
same reason ``embed_session`` uses it: the token was minted while the
caller was on this app's own origin, not a customer's, so the stored
origin can never match a customer origin here. ``origin`` is otherwise
unused on that path and is passed empty.

## Headers

- `x-impersonate-identity-id` string, nullable

## Request body

- VisitorClaimBody
  - `agent_identity_id` string, uuid, required
  - `visitor_token` string, required

## Response `200`

Successful Response

- VisitorClaimResponse
  - `chat_id` string, nullable, required
  - `facts_migrated` integer, required
  - `already_claimed` boolean, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/thinqos/apis/thinqos-api.md) · [All operations](https://skmtc.dev/thinqos/apis/thinqos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinqos/apis/thinqos-api/revisions/ce2c2ce318b1?raw)